Re: [PATCH] perf/core: Strengthen userpage update ordering

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Preexisting seqlock writer re-entrancy bug in perf_event_update_userpage leading to corrupted data for userspace readers.
--

commit 019372a4e61c18f0c5a22ddb487c7acef14ffc7e
Author: Thaumy Cheng <thaumy.love@gmail.com>

perf/core: Strengthen userpage update ordering

This commit replaces compiler barriers with smp_wmb() around the userpage
payload update in perf_event_update_userpage(). It aims to strengthen the
publication ordering for cross-CPU readers of time conversion fields on
weakly ordered architectures.

> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index a6c8e38a31104..9c6dfb79fd77d 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -6858,7 +6858,8 @@ void perf_event_update_userpage(struct perf_event *event)
>  	userpg = rb->user_page;
>  
>  	++userpg->lock;
> -	barrier();
> +	/* Publish the odd lock value before updating the payload. */
> +	smp_wmb();

[Severity: High]
This is a pre-existing issue, but does perf_event_update_userpage() have a
seqlock writer re-entrancy bug here that defeats the synchronization?

Since this function disables preemption (via preempt_disable() earlier in
the function) but leaves hardware interrupts enabled when called from task
context (such as from perf_mmap_rb()), what happens if a PMU hardware
interrupt like an NMI triggers during this window? 

If the NMI handler also calls perf_event_update_userpage() for the same
event, it would increment userpg->lock again, advancing it to an even value.
A concurrent userspace reader on another CPU would then see an even lock
value and could read actively-torn payload data (like time_mult, time_shift,
or time_offset), leading to bogus timestamps. 

Should hardware interrupts be disabled before incrementing the seqlock to
prevent this writer re-entrancy?

>  	userpg->index = perf_event_index(event);
>  	userpg->offset = perf_event_count(event, false);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260906122350.24305-1-thaumy.love@gmail.com?part=1